| Package | Affected versions | Patched versions |
|---|---|---|
| notepad++ | ≤ 1.0≤ 1.1≤ 1.2≤ 1.3≤ 1.4≤ 1.5≤ 1.6≤ 1.7≤ 1.8≤ 1.9≤ 2.1≤ 2.2≤ 2.3≤ 2.4≤ 2.5≤ 2.6≤ 2.8≤ 2.9≤ 3.0≤ 3.1≤ 3.2≤ 3.3≤ 3.4≤ 3.5≤ 3.6≤ 3.7≤ 3.8≤ 3.9≤ 4.0≤ 4.0.2≤ 4.1≤ 4.1.1≤ 4.1.2≤ 4.2.1≤ 4.2.2≤ 4.3≤ 4.4≤ 4.5≤ 4.6≤ 4.7≤ 4.7.2 |
The GUP generic update process in Notepad++ before 4.8.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free